ucp-embedded-checkout

Human escalation for agent-initiated checkout in an iframe is handled by implementing the UCP Embedded Checkout Protocol to facilitate secure communication between the merchant UI and host platform. It allows buyers to confirm details or select shipping options securely.

JSON-RPC 2.0 over postMessage for iframe checkout communication works by establishing a secure messaging channel between the merchant's iframe and the host platform, enabling delegated actions like payment credential acquisition and order completion.

Yes, Content Security Policy, origin validation, and sandboxing are required for embedded checkout to adhere to strict security requirements, ensuring the iframe-based checkout UI escalation protects payment credentials and buyer interactions.

The best way to delegate payment credential acquisition to a host platform is using the UCP Embedded Checkout Protocol, which allows the merchant iframe to securely request and facilitate actions from the host via JSON-RPC 2.0.

Yes, you can use a sandboxed iframe for agent checkout workflows requiring buyer confirmation by opening the provided continue URL within the iframe, ensuring secure communication and strict origin validation during the escalation process.

Embedded checkout should be used over direct API calls when an agent-initiated checkout requires human intervention, such as when a buyer needs to confirm details or select shipping options via a merchant's website within a secure iframe.